Splunk Search

Why am I getting an error on this timechart syntax when trying to display two curves?

jip31
Motivator

Hello
I need help to display two curves in my chart and the 2 curves refer to host="$field1$ and host="$field2$
So I am trying to do an eval(avg(if(host="$field1$..... host="$field2$.... in timechart pipe
I also need a round number with 2 decimals of the field "PercentProcessorTime" but I always have errors.
Could you help me, please?

   index="windows-wmi" sourcetype="WMI:CPUload"  host="$field1$" (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$  host="$field2$" (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$ 
        | rex field=Name "^(?<Service>[^\/]+)[\/]" 

    | sort -_time 

    | rex field=Name "^(?<Service>[^\/]+)[\/]" 

    | sort -_time 
    |timechart span=10m avg(PercentProcessorTime) as PercentProcessorTime_AVG by Service
0 Karma
1 Solution

niketn
Legend

@jip31, before we begin to look at your actual issue, some corrections
1) (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$ in your base search are mentioned twice and have no effect on filtering results. You should have only one.
2) Following is mentioned twice in your search which seems copy paste error:

 | rex field=Name "^(?<Service>[^\/]+)[\/]" 
 | sort -_time

3) By defaults events are sorted in reverse chronological order and timechart should show them up properly without sort - _time. This seems to be just an overhead to your current query. Even if you need this for some other reason like working with streamstats then reverse is a better command.

Having said these can you share your current output and also what is the expected output? When you mentioned two curves by hosts what did you mean? Can you add a mock screenshot or table output of what is required?

Can you try the following to see if it works for you?

 index="windows-wmi" sourcetype="WMI:CPUload"  host="$field1$" (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$
| rex field=Name "^(?<Service>[^\/]+)[\/]" 
| eval key=Service."-".host
| timechart span=10m avg(PercentProcessorTime) as PercentProcessorTime_AVG by key
| eval PercentProcessorTime_AVG =round(PercentProcessorTime_AVG,1)
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@jip31, before we begin to look at your actual issue, some corrections
1) (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$ in your base search are mentioned twice and have no effect on filtering results. You should have only one.
2) Following is mentioned twice in your search which seems copy paste error:

 | rex field=Name "^(?<Service>[^\/]+)[\/]" 
 | sort -_time

3) By defaults events are sorted in reverse chronological order and timechart should show them up properly without sort - _time. This seems to be just an overhead to your current query. Even if you need this for some other reason like working with streamstats then reverse is a better command.

Having said these can you share your current output and also what is the expected output? When you mentioned two curves by hosts what did you mean? Can you add a mock screenshot or table output of what is required?

Can you try the following to see if it works for you?

 index="windows-wmi" sourcetype="WMI:CPUload"  host="$field1$" (Name="mfetp/*" OR Name="mcshield/*") Name=$Service$
| rex field=Name "^(?<Service>[^\/]+)[\/]" 
| eval key=Service."-".host
| timechart span=10m avg(PercentProcessorTime) as PercentProcessorTime_AVG by key
| eval PercentProcessorTime_AVG =round(PercentProcessorTime_AVG,1)
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jip31
Motivator

hi 2 curves because I have 2 hosts: host="$field1$ and host="$field2$

i wrote this :
index="windows-wmi" sourcetype="WMI:CPUload" host="$field1$" (Name="mfetp/" OR Name="mcshield/") Name=$Service$
| rex field=Name "^(?[^\/]+)[\/]" | eval key=Service."-".host | timechart span=10m avg(PercentProcessorTime) as PercentProcessorTime_AVG, avg(PercentProcessorTime) as PercentProcessorTime_AVG by key | eval PercentProcessorTime_AVG =round(PercentProcessorTime_AVG,1)

Is it correct??
Is someone could give me another solution with eval(avg(if.... please??

0 Karma

manish_singh_77
Builder

Are you trying to display host information on graph, please elaborate, I did not get your question.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...